In typical cryptographic systems, one or more encryption keys are created on the sender's computer or device and are used to transit an encrypted message to another computer or device. The receiver also has one or more encryption keys to decrypt the message. Typical encryption keys have a length of 128 bits, 256 bits, 512 bits, 2048 bits or sometimes larger. Since most people are incapable of remembering an encryption key this long, these encryption keys are stored on a computer or other device that often requires a shorter, less secure, password to access. This creates a situation, where the password is often much easier to obtain than the encryption keys. Furthermore, many operating systems have many security flaws, so often a sophisticated intruder does not have to obtain the password. The intruder can gain access to the computer containing the encryption keys, and the cryptographic system's security is compromised.
It is possible to scan fingerprints into computers, rather than enter a password, to access computers. However, such systems are unsecure, because the fingerprints, or derived fingerprint information, can be captured by an intruder. Consequently, the security of the whole system is compromised.
Some Advantages Over Other Systems
The decentralization of the security makes the systems and methods presented here, more secure and helps preserve the user's privacy. Privacy is important in regard to preventing identity theft. In some inferior security systems, the keys are pre-programmed during a particular time of manufacturing. This creates a centralized point of security that can be exploited by hackers and criminals. They can reverse engineer the devices and figure out what the keys are. With this decentralization of the system, the creation of the keys for a particular user or device is localized. This decentralization of the security helps prevent catastrophic break-ins or breaches. These types of catastrophic security breaches for inferior systems are all to common as hackers and terrorists have universal access to many critical systems via the Internet.
This decentralization of the security also enhances the usability of the system. In some inferior systems, administrators set up the keys and perform various “personalizations.” For these types of inferior systems, the logistics of the IT support on thousands or millions or tens of millions of users is so cumbersome that they are unusable. For example, a credit card company may issue 100 million cards that require administrators for the administrator keyes, which can create an administrative nightmare in addition to giving the administrator access to personal information of a substantial number of people. An administrator with access to personal information may also create a big security and identity theft risk. One of Biogy's advantages is that the keys are generated locally in the field via a user-implemented process, based on the uniqueness of the user. This creates a unique and decentralized key generation, which also prevents hackers and thieves from carrying out a massive attack on millions of cards. As an analogy for Biogy's superior security by decentralization, consider that terrorists might want to cripple the U.S. energy supply, economy or military. There is greater security in having 100,000 small energy resources—analogous to the user implemented initialization—decentralized uniformly across the U.S. rather than having, for example, three giant oil refineries and/or three large nuclear power plants providing all of our energy needs. Using three giant oil companies and/or three nuclear power plants is analogous to inferior systems using a centralized, administrator-implemented set up.
Another advantage is that in some embodiments the passcodes used here are temporary. In this case, they are more difficult to compromise. In some embodiments with a wireless device, the passcode may be transmitted wirelessly and the passcode may last a few microseconds or a few seconds. In some embodiments, the passcode may appear on a display screen of a flash drive, smart card, or a mobile phone or PDA. This passcode may last a few seconds or written down by the user and used in a few hours—before it is typed in and no longer in use. In some embodiments, a mobile device may run on a battery or solar power, where the passcode may be automatically transmitted through a USB, micro USB port or some other hardware port. If the device is authenticated in a user's hands where it is not yet plugged into the port, then the passcode may last a few seconds or a few minutes before it is plugged into the port.